v0.7.1
What's Changed
-
Harden
/tmpcache handling against local attacks. Moves all cache files from shared/tmpto a private per-user directory ($XDG_RUNTIME_DIR/claude-paceor~/.cache/claude-pace). Adds numeric validation on all cache-read fields before arithmetic evaluation, replacesecho -ewithprintf '%s\n'to prevent terminal escape injection, and switches the cache record delimiter from|to ASCII Unit Separator so branch names containing|cannot corrupt field parsing. When no safe cache directory is available, caching is disabled entirely and the script falls back to live computation.Thanks to @mairas for flagging the
/tmpsafety concern in #6.
Full Changelog: v0.7.0...v0.7.1